httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Milan Tomic <tomicmi...@yahoo.com>
Subject [users@httpd] SSL: Forwarding user certificate from apache to another server
Date Wed, 30 Aug 2006 13:14:45 GMT

Users log into apache through SSL and I'm forwarding user cert from apache to (another) app
server. The problem is that user cert, which is sent as HTTP header param (base64 encoded),
spans
several lines:

GET /LoginTest/servletheaderview HTTP/1.1
Host: duke:4444
Accept: */*
Accept-Language: sl
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET
CLR
1.1.4322)
SSL_CLIENT_CERT: -----BEGIN CERTIFICATE-----
MIIFpDCCBIygAwIBAgIEPAtSvjANBgkqhkiG9w0BAQUFADA+MQswCQYDVQQGEwJz
aTEbMBkGA1UEChMSc3RhdGUtaW5zdGl0dXRpb25zMRIwEAYDVQQLEwlzaXRlc3Qt
*** not all lines were shown ***
KCY7/laFwZBHMdT/lpjMwt1szHXIFIS4/PcTTpjd4j6Nd2RcWX9uKwsRYUQ7kgfx
A+cpsvYdoDI=
-----END CERTIFICATE-----

Max-Forwards: 10
Via: 1.1 www.example.com
X-Forwarded-For: 10.9.72.251

Well, the actual problem is to parse SSL_CLIENT_CERT variable on iAS, Tomcat or some other
server.
Is this standard HTTP 1.1 notation for headers params with multiple lines? Is Apache forwarding
right? Above shown HTTP request is sent from Apache to iAS server.

This is what I set in my ssl.conf to tell Apache to forward cert:

RequestHeader set SSL_CLIENT_CERT %{SSL_CLIENT_CERT}e 
ProxyPass / http://duke:4444/LoginTest/servletheaderview
ProxyPassReverse / http://duke:4444/LoginTest/servletheaderview



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message